Intrusion Detection Services trace (SYSTCPIS)

When starting the TCP stack, the stack reads the CTIIDS00 parmlib member to determine the size to reserve for the SYSTCPIS CTRACE. You can override this default by starting TCP/IP with the PARM option and the keyword IDS=xx, where xx is the suffix of the CTIIDSxx PARMLIB member. In the following example, the trace searches for PARMLIB member CTIIDSA3.

S tcpiproc,PARM='IDS=A3'

If the parmlib member is not found or the member contains data that is not valid, the following message is displayed.

EZZ4210I CTRACE DEFINE FAILED FOR CTIIDS00

If the EZZ4210I message indicates the parmlib member name CTIIDS00, the IDS CTRACE space is set up using the default BUFSIZE of 32M.

The CTIIDS00 member is used to specify the IDS CTRACE parameters. To eliminate this message, ensure that a CTIIDS00 member exists within Parmlib and that the options are correctly specified. A sample CTIIDS00 member is shipped with z/OS® Communications Server.

Packets are traced based on IDS policy. See Intrusion Detection Services in z/OS Communications Server: IP Configuration Guide for information about defining policy.

See Diagnosing intrusion detection problems for additional information about diagnosing policy problems.

Figure 1. SYS1.PARMLIB member CTIIDS00

/********************************************************************/
/*                                                                  */
/*  IBM Communications Server for z/OS                              */
/*  SMP/E Distribution Name: CTIIDS00                               */
/*                                                                  */
/*  MEMBER:  CTIIDS00                                               */
/*                                                                  */
/*                                                                  */
/*  Copyright:                                                      */
/*                Licensed Materials - Property of IBM              */
/*                5694-A01                                          */
/*                (C) Copyright IBM Corp. 2001, 2003                */
/*                                                                  */
/*                                                                  */
/*  Status:       CSV1R5                                            */
/*                                                                  */
/*                                                                  */
/*  DESCRIPTION = This parmlib member causes IDS component trace    */
/*                for the TCP/IP product to be initialized with a   */
/*                trace buffer size of 32M.                         */
/*                                                                  */
/*                This parmlib members only lists those TRACEOPTS   */
/*                value specific to TCP/IP.  For a complete list    */
/*                of TRACEOPTS keywords and their values see        */
/*                z/OS MVS INITIALIZATION AND TUNING REFERENCE.     */
/*                                                                  */
/* $MAC(CTIIDS00) PROD(TCPIP): Component Trace SYS1.PARMLIB member  */
/*                                                                  */
/*                                                                  */
/********************************************************************/
 TRACEOPTS
 /* ---------------------------------------------------------------- */
 /*   ON OR OFF: PICK 1                                              */
 /* ---------------------------------------------------------------- */
           ON
 /*        OFF                                                       */
 /* ---------------------------------------------------------------- */
 /*   BUFSIZE: A VALUE IN RANGE 16M TO 256M                          */
 /* ---------------------------------------------------------------- */
           BUFSIZE(32M)
 /*        WTR(wtr_procedure) WRAP|NOWRAP                            */